add: 2026-06-20 kevlar iocs

1 files changed, 46 insertions, 0 deletions

diff --git a/kevlar/2026-06-20/OPERATIONS_LOG.md b/kevlar/2026-06-20/OPERATIONS_LOG.md
new file mode 100644
index 0000000..494e84a
--- /dev/null
+++ b/kevlar/2026-06-20/OPERATIONS_LOG.md
@@ -0,0 +1,46 @@
+# Operations Log -- Weekly BP Report 2026-06-20
+
+## 2026-06-22 10:35:00 -- Phase 0: Initialize
+- ASNs loaded: 26
+- Run date: 2026-06-20 (week of 2026-06-14 through 2026-06-20)
+- Prior run: 2026-06-15
+- Censys credits: 10,000 (sufficient for per-IP enrichment)
+- Cache dirs: sponge/, honeylabs/, censys/, changes/, iocs/
+
+## 2026-06-22 10:40:15 -- Phase 1: Sponge Data Gathering
+- ASNs with data: 15 of 26
+- Total sessions observed: ~180,000+ across all monitored ASNs
+- Top ASN: AS51396 (PFCLOUD) -- 96,045 sessions
+- Second: AS138915 (KAOPU-HK) -- 78,971 sessions
+- 11 ASNs with zero observed activity
+- Timeline captured: hourly split across top 5 ASNs
+- Data cached to sponge/ directory
+
+## 2026-06-22 10:42:00 -- Phase 2: Honeylabs Queries
+- ASNs queried: 20 (all active)
+- Active ASNs found: 11 (AS51396, AS138915, AS51852, AS14956, AS210644, AS214940, AS400992, AS198953, AS200651, AS200593, AS209847)
+- Top ASN: AS51396 (PFCLOUD) -- ~14,700 events across 20+ IPs
+- Fingerprints captured: JA4/JA4H from KAOPU-HK
+- Data cached to honeylabs/ directory
+
+## 2026-06-22 10:43:00 -- Phase 3: Censys Infrastructure Profiling
+- ASNs aggregated: 7 (port, software, labels)
+- All active ASNs carry BULLETPROOF label
+- Notable: HOSTKEY-AS (AS57043) has 99,992 hosts (new entry)
+- PFCLOUD: 3,476 hosts (+1.5%), wg-easy most common software
+- KAOPU-HK: 34,264 hosts (-4.6%), OpenResty+Tengine stack
+- Data cached to censys/ directory
+
+## 2026-06-22 10:43:30 -- Phase 4: Change Detection
+- Prior baseline: 2026-06-15
+- Changes: HOSTKEY-AS new entry, PROTON66 normalization (42K->112 events)
+- Anomalies flagged: 2
+
+## 2026-06-22 10:44:00 -- Phase 5: Blog Post
+- File: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-06-20-weekly-bulletproof-report.md
+- Sections: Executive Summary, By the Numbers, Top ASN Deep Dives, Infrastructure Correlation, Fleet Observations, IoCs
+- Build: passed (0 errors, 0 warnings)
+
+## 2026-06-22 10:45:00 -- Phase 6: IoC Archival
+- Files: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md
+- IPs archived: ~75 across 15 active ASNs